Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
153s -
max time network
44s -
platform
windows7_x64 -
resource
win7-20220812-en -
resource tags
arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system -
submitted
11/10/2022, 11:35
Static task
static1
Behavioral task
behavioral1
Sample
f50e655ae92bbb753e145cbb905a985db854cafd4af7b60a30ca88010f912797.exe
Resource
win7-20220812-en
windows7-x64
17 signatures
150 seconds
Behavioral task
behavioral2
Sample
f50e655ae92bbb753e145cbb905a985db854cafd4af7b60a30ca88010f912797.exe
Resource
win10v2004-20220812-en
windows10-2004-x64
9 signatures
150 seconds
General
-
Target
f50e655ae92bbb753e145cbb905a985db854cafd4af7b60a30ca88010f912797.exe
-
Size
341KB
-
MD5
6cadb955f78ae587d525ee714fc431d0
-
SHA1
23be952782126ed5f9a26223e1fba8dc5a5fda30
-
SHA256
f50e655ae92bbb753e145cbb905a985db854cafd4af7b60a30ca88010f912797
-
SHA512
a3b1f64e1e4ae391eff08d5edd94e47dd3b8e60819819a102e8a06bc7baa4a86e55cd0c00b113b780d65abe9a86b4301048295b6352c73d972b16e5ba9aff515
-
SSDEEP
3072:/BI5ArKGCnhgU1XA+ArXjeaMoh6lgUaVwQ+/76bSSN+PS7VyoCeJ6ikm6bm:/K5ArKjbAxXSaegUqGeGpBohMb
Score
8/10
Malware Config
Signatures
-
Executes dropped EXE 3 IoCs
pid Process 1696 icsuskey.exe 472 ~5909.tmp 1596 dcomperf.exe -
Loads dropped DLL 3 IoCs
pid Process 1132 f50e655ae92bbb753e145cbb905a985db854cafd4af7b60a30ca88010f912797.exe 1132 f50e655ae92bbb753e145cbb905a985db854cafd4af7b60a30ca88010f912797.exe 1696 icsuskey.exe -
Adds Run key to start application 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Run\dpnsance = "C:\\Users\\Admin\\AppData\\Roaming\\Presetup\\icsuskey.exe" f50e655ae92bbb753e145cbb905a985db854cafd4af7b60a30ca88010f912797.exe -
Drops file in System32 directory 1 IoCs
description ioc Process File created C:\Windows\SysWOW64\dcomperf.exe f50e655ae92bbb753e145cbb905a985db854cafd4af7b60a30ca88010f912797.exe -
Drops file in Windows directory 1 IoCs
description ioc Process File opened for modification C:\Windows\Debug\WIA\wiatrace.log WINWORD.EXE -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Office loads VBA resources, possible macro or embedded object present
-
description ioc Process Key created \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\Toolbar WINWORD.EXE Key deleted \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor\shell\edit\COMMAND WINWORD.EXE Set value (str) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\MenuExt\Se&nd to OneNote\ = "res://C:\\PROGRA~2\\MICROS~1\\Office14\\ONBttnIE.dll/105" WINWORD.EXE Key deleted \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor\shell\edit WINWORD.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor\shell\edit\command WINWORD.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor\shell WINWORD.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor\shell\edit WINWORD.EXE Set value (data) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor\shell\edit\command\command = 7800620027004200560035002100210021002100210021002100210021004d004b004b0053006b0057004f0052004400460069006c00650073003e00620069002400540021005600210030005a003d007b0050006b00300076006d007e0041005a00750020002f006e002000220025003100220000000000 WINWORD.EXE Key deleted \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor\shell\edit WINWORD.EXE Key created \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\MenuExt\Se&nd to OneNote WINWORD.EXE Set value (str) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\MenuExt\E&xport to Microsoft Excel\ = "res://C:\\PROGRA~2\\MICROS~1\\Office14\\EXCEL.EXE/3000" WINWORD.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor\shell\edit\command\ = "\"C:\\Program Files (x86)\\Microsoft Office\\Office14\\WINWORD.EXE\" /n \"%1\"" WINWORD.EXE Key created \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\MenuExt\E&xport to Microsoft Excel WINWORD.EXE Key deleted \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor\shell WINWORD.EXE Set value (data) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor\shell\edit\command\command = 7800620027004200560035002100210021002100210021002100210021004d004b004b0053006b0057004f0052004400460069006c00650073003e00620069002400540021005600210030005a003d007b0050006b00300076006d007e0041005a00750020002f006e002000220025003100220000000000 WINWORD.EXE Key deleted \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor WINWORD.EXE Set value (str) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\Toolbar\ShowDiscussionButton = "Yes" WINWORD.EXE Key created \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\MenuExt WINWORD.EXE Key deleted \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor\shell WINWORD.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor\shell\edit WINWORD.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor\shell\edit\ = "&Edit" WINWORD.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor\shell\edit\command\ = "\"C:\\Program Files (x86)\\Microsoft Office\\Office14\\WINWORD.EXE\" /n \"%1\"" WINWORD.EXE Set value (int) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\MenuExt\E&xport to Microsoft Excel\Contexts = "1" WINWORD.EXE Key deleted \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor WINWORD.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor WINWORD.EXE Set value (int) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\MenuExt\Se&nd to OneNote\Contexts = "55" WINWORD.EXE Key deleted \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor\shell\edit\COMMAND WINWORD.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor WINWORD.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor\shell WINWORD.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor\shell\edit\ = "&Edit" WINWORD.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor\shell\edit\command WINWORD.EXE -
Modifies registry class 64 IoCs
description ioc Process Set value (data) \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Microsoft Excel\shell\edit\command\command = 7800620027004200560035002100210021002100210021002100210021004d004b004b0053006b0045005800430045004c00460069006c00650073003e00560069006a00710042006f006600280059003800270077002100460049006400310067004c00510020002f0064006400650000000000 WINWORD.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Excel.exe\shell\edit\command WINWORD.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\MSPub.exe\shell\edit\command\ = "\"C:\\Program Files (x86)\\Microsoft Office\\Office14\\MSPUB.EXE\" %1" WINWORD.EXE Set value (data) \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\MSPub.exe\shell\edit\command\command = 7800620027004200560035002100210021002100210021002100210021004d004b004b0053006b005000750062005000720069006d006100720079003e00520024006e0075006a0053005700460065003f007d0061004c00720052007000390078004000570020002500310000000000 WINWORD.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Microsoft Publisher\shell\edit\command\ = "\"C:\\Program Files (x86)\\Microsoft Office\\Office14\\MSPUB.EXE\" %1" WINWORD.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\htmlfile\shell\Print\command\ = "\"C:\\Program Files (x86)\\Microsoft Office\\Office14\\msohtmed.exe\" /p %1" WINWORD.EXE Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\mhtmlfile\shell\Print WINWORD.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Excel.exe WINWORD.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{42042206-2D85-11D3-8CFF-005004838597} WINWORD.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\htmlfile\shell WINWORD.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\mhtmlfile\shell\Edit\command\ = "\"C:\\Program Files (x86)\\Microsoft Office\\Office14\\msohtmed.exe\" %1" WINWORD.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Microsoft Excel\shell\edit\ddeexec\application\ = "Excel" WINWORD.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Microsoft Excel\shell\edit\ddeexec\topic\ = "system" WINWORD.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Excel.exe\shell\edit\ = "&Open" WINWORD.EXE Set value (data) \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Microsoft Publisher\shell\edit\command\command = 7800620027004200560035002100210021002100210021002100210021004d004b004b0053006b005000750062005000720069006d006100720079003e00520024006e0075006a0053005700460065003f007d0061004c00720052007000390078004000570020002500310000000000 WINWORD.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\MSPub.exe\shell\edit\command WINWORD.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Microsoft Excel\shell\edit\command\ = "\"C:\\Program Files (x86)\\Microsoft Office\\Office14\\EXCEL.EXE\" /dde" WINWORD.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Microsoft Excel\shell\edit\ddeexec\topic\ = "system" WINWORD.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Excel.exe\shell\edit\ = "&Open" WINWORD.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Excel.exe\shell\edit\ddeexec\application WINWORD.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Microsoft Excel\shell\edit\ddeexec\ = "[open(\"%1\")]" WINWORD.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\mhtmlfile\shell WINWORD.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\mhtmlfile\ShellEx WINWORD.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Microsoft Word\shell\edit\command WINWORD.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Excel.exe\shell\edit\ddeexec WINWORD.EXE Set value (data) \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Excel.exe\shell\edit\command\command = 7800620027004200560035002100210021002100210021002100210021004d004b004b0053006b0045005800430045004c00460069006c00650073003e00560069006a00710042006f006600280059003800270077002100460049006400310067004c00510020002f0064006400650000000000 WINWORD.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{42042206-2D85-11D3-8CFF-005004838597}\Version WINWORD.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\htmlfile WINWORD.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\htmlfile\shell\Print\command WINWORD.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Excel.exe\shell\edit\command\ = "\"C:\\Program Files (x86)\\Microsoft Office\\Office14\\EXCEL.EXE\" /dde" WINWORD.EXE Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\mhtmlfile\shell\Print\command WINWORD.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{42042206-2D85-11D3-8CFF-005004838597}\Version\14\ = "C:\\Program Files (x86)\\Microsoft Office\\Office14\\msohtmed.exe" WINWORD.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\MSPub.exe\shell\edit\ = "&Open" WINWORD.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{42042206-2D85-11D3-8CFF-005004838597}\Old Icon\mhtmlfile WINWORD.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Microsoft Publisher\shell\edit WINWORD.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\MSPub.exe WINWORD.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{42042206-2D85-11D3-8CFF-005004838597}\InprocServer32\ = "C:\\Program Files (x86)\\Microsoft Office\\Office14\\msohevi.dll" WINWORD.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Microsoft Word WINWORD.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\MSPub.exe WINWORD.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\MSPub.exe\shell\edit WINWORD.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Excel.exe WINWORD.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Microsoft Excel\shell\edit\ddeexec WINWORD.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\mhtmlfile\shell\Edit\ = "&Edit" WINWORD.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\WinWord.exe\shell\edit\command WINWORD.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\WinWord.exe\shell\edit\command\ = "\"C:\\Program Files (x86)\\Microsoft Office\\Office14\\WINWORD.EXE\" /n \"%1\"" WINWORD.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Microsoft Excel\shell\edit WINWORD.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Microsoft Excel\shell\edit\command WINWORD.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\mhtmlfile\shell\Edit WINWORD.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList WINWORD.EXE Set value (data) \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Microsoft Word\shell\edit\command\command = 7800620027004200560035002100210021002100210021002100210021004d004b004b0053006b0057004f0052004400460069006c00650073003e00620069002400540021005600210030005a003d007b0050006b00300076006d007e0041005a00750020002f006e002000220025003100220000000000 WINWORD.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Microsoft Publisher\shell\edit WINWORD.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Microsoft Excel WINWORD.EXE Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\htmlfile\shell\Edit WINWORD.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\htmlfile\shell\Print WINWORD.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\WinWord.exe\shell\edit WINWORD.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Microsoft Word\shell\edit\command\ = "\"C:\\Program Files (x86)\\Microsoft Office\\Office14\\WINWORD.EXE\" /n \"%1\"" WINWORD.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Excel.exe\shell\edit\ddeexec\application\ = "Excel" WINWORD.EXE Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\htmlfile\shell\Print WINWORD.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\WinWord.exe\shell\edit\ = "&Open" WINWORD.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Microsoft Excel\shell\edit\ddeexec\topic WINWORD.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\htmlfile\shell\Print\ = "&Print" WINWORD.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\htmlfile\DefaultIcon\ = "\"%1\"" WINWORD.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Microsoft Excel\shell\edit\ddeexec\ = "[open(\"%1\")]" WINWORD.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Microsoft Publisher\shell\edit\command WINWORD.EXE -
Suspicious behavior: AddClipboardFormatListener 1 IoCs
pid Process 588 WINWORD.EXE -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 1696 icsuskey.exe 1212 Explorer.EXE 1596 dcomperf.exe 1212 Explorer.EXE 1596 dcomperf.exe 1212 Explorer.EXE 1596 dcomperf.exe 1212 Explorer.EXE 1596 dcomperf.exe 1212 Explorer.EXE 1596 dcomperf.exe 1212 Explorer.EXE 1596 dcomperf.exe 1212 Explorer.EXE 1596 dcomperf.exe 1212 Explorer.EXE 1596 dcomperf.exe 1212 Explorer.EXE 1596 dcomperf.exe 1212 Explorer.EXE 1596 dcomperf.exe 1212 Explorer.EXE 1596 dcomperf.exe 1212 Explorer.EXE 1596 dcomperf.exe 1212 Explorer.EXE 1596 dcomperf.exe 1212 Explorer.EXE 1596 dcomperf.exe 1212 Explorer.EXE 1596 dcomperf.exe 1212 Explorer.EXE 1596 dcomperf.exe 1212 Explorer.EXE 1596 dcomperf.exe 1212 Explorer.EXE 1596 dcomperf.exe 1212 Explorer.EXE 1596 dcomperf.exe 1212 Explorer.EXE 1596 dcomperf.exe 1212 Explorer.EXE 1596 dcomperf.exe 1212 Explorer.EXE 1596 dcomperf.exe 1212 Explorer.EXE 1596 dcomperf.exe 1212 Explorer.EXE 1596 dcomperf.exe 1212 Explorer.EXE 1596 dcomperf.exe 1212 Explorer.EXE 1596 dcomperf.exe 1212 Explorer.EXE 1596 dcomperf.exe 1212 Explorer.EXE 1596 dcomperf.exe 1212 Explorer.EXE 1596 dcomperf.exe 1212 Explorer.EXE 1596 dcomperf.exe 1212 Explorer.EXE 1596 dcomperf.exe 1212 Explorer.EXE -
Suspicious use of AdjustPrivilegeToken 7 IoCs
description pid Process Token: SeShutdownPrivilege 1212 Explorer.EXE Token: SeShutdownPrivilege 1212 Explorer.EXE Token: SeShutdownPrivilege 1212 Explorer.EXE Token: SeShutdownPrivilege 1212 Explorer.EXE Token: SeShutdownPrivilege 1212 Explorer.EXE Token: SeShutdownPrivilege 1212 Explorer.EXE Token: SeShutdownPrivilege 1212 Explorer.EXE -
Suspicious use of FindShellTrayWindow 12 IoCs
pid Process 1212 Explorer.EXE 1212 Explorer.EXE 1212 Explorer.EXE 1212 Explorer.EXE 1212 Explorer.EXE 1212 Explorer.EXE 1212 Explorer.EXE 1212 Explorer.EXE 1212 Explorer.EXE 1212 Explorer.EXE 1212 Explorer.EXE 1212 Explorer.EXE -
Suspicious use of SendNotifyMessage 4 IoCs
pid Process 1212 Explorer.EXE 1212 Explorer.EXE 1212 Explorer.EXE 1212 Explorer.EXE -
Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 588 WINWORD.EXE 588 WINWORD.EXE -
Suspicious use of UnmapMainImage 9 IoCs
pid Process 1212 Explorer.EXE 1212 Explorer.EXE 1212 Explorer.EXE 1212 Explorer.EXE 1212 Explorer.EXE 1212 Explorer.EXE 1212 Explorer.EXE 1212 Explorer.EXE 1212 Explorer.EXE -
Suspicious use of WriteProcessMemory 17 IoCs
description pid Process procid_target PID 1132 wrote to memory of 1696 1132 f50e655ae92bbb753e145cbb905a985db854cafd4af7b60a30ca88010f912797.exe 27 PID 1132 wrote to memory of 1696 1132 f50e655ae92bbb753e145cbb905a985db854cafd4af7b60a30ca88010f912797.exe 27 PID 1132 wrote to memory of 1696 1132 f50e655ae92bbb753e145cbb905a985db854cafd4af7b60a30ca88010f912797.exe 27 PID 1132 wrote to memory of 1696 1132 f50e655ae92bbb753e145cbb905a985db854cafd4af7b60a30ca88010f912797.exe 27 PID 1696 wrote to memory of 472 1696 icsuskey.exe 28 PID 1696 wrote to memory of 472 1696 icsuskey.exe 28 PID 1696 wrote to memory of 472 1696 icsuskey.exe 28 PID 1696 wrote to memory of 472 1696 icsuskey.exe 28 PID 472 wrote to memory of 1212 472 ~5909.tmp 16 PID 1132 wrote to memory of 588 1132 f50e655ae92bbb753e145cbb905a985db854cafd4af7b60a30ca88010f912797.exe 30 PID 1132 wrote to memory of 588 1132 f50e655ae92bbb753e145cbb905a985db854cafd4af7b60a30ca88010f912797.exe 30 PID 1132 wrote to memory of 588 1132 f50e655ae92bbb753e145cbb905a985db854cafd4af7b60a30ca88010f912797.exe 30 PID 1132 wrote to memory of 588 1132 f50e655ae92bbb753e145cbb905a985db854cafd4af7b60a30ca88010f912797.exe 30 PID 588 wrote to memory of 616 588 WINWORD.EXE 33 PID 588 wrote to memory of 616 588 WINWORD.EXE 33 PID 588 wrote to memory of 616 588 WINWORD.EXE 33 PID 588 wrote to memory of 616 588 WINWORD.EXE 33
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of UnmapMainImage
PID:1212 -
C:\Users\Admin\AppData\Local\Temp\f50e655ae92bbb753e145cbb905a985db854cafd4af7b60a30ca88010f912797.exe"C:\Users\Admin\AppData\Local\Temp\f50e655ae92bbb753e145cbb905a985db854cafd4af7b60a30ca88010f912797.exe"2⤵
- Loads dropped DLL
- Adds Run key to start application
- Drops file in System32 directory
- Suspicious use of WriteProcessMemory
PID:1132 -
C:\Users\Admin\AppData\Roaming\Presetup\icsuskey.exe"C:\Users\Admin\AppData\Roaming\Presetup\icsuskey.exe"3⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:1696 -
C:\Users\Admin\AppData\Local\Temp\~5909.tmp"C:\Users\Admin\AppData\Local\Temp\~5909.tmp"4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:472
-
-
-
C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE"C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE" /n "C:\Users\Admin\AppData\Local\Temp\~5FEC.tmp.doc"3⤵
- Drops file in Windows directory
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:588 -
C:\Windows\splwow64.exeC:\Windows\splwow64.exe 122884⤵PID:616
-
-
-
-
C:\Windows\SysWOW64\dcomperf.exeC:\Windows\SysWOW64\dcomperf.exe -k1⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
PID:1596
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
6KB
MD580bcb0449794dd6c238433a3bd26f5a0
SHA18401251d30803d2bbf0b5b30c027f7446c2d0542
SHA256e07abfe8de7d8acdf74f2ffd3b84e2bd1dbaac5eeffceef4051e21bbc3f02bba
SHA512c5d8a80acf601b19a1cdeb6f129ba37fb3620ddd031c5cd67f8f1e1e26247f3243b884d4bb305f614b794aec42820c69373644309e79c4066c6df7c0f6fc2870
-
Filesize
23KB
MD5a95c33af41a5ce76875f688de01f490f
SHA1a57191165c5dedcc863bf5e6de59d86524fac95b
SHA2564eb1c28be2791f73abbb7caffbe3ff96628813bbb8ab10f38cdb63a7e8fd2632
SHA512ba8ca879018964a21c10658adf297486d996888b897d906336d89934dc494adafc01391f841323a7430c5e29f3d40bcb4073e28bd0a772012aa45b8da89ad4e1
-
Filesize
172KB
MD5981caaf0bbb52e42de8b8f4cb25d45cf
SHA10907e441c8feb7cdea8be6141af288ada0458958
SHA2564ecd468b163b404534c85cca633d5e5c1e6fecdd064046a4d6956e4d4b11b7b1
SHA512b0be2a3caf17f029e2c480eb5398c63fd33934198980d7e01321cd2dbc52a8c91079be9ec4a8041eb4c405d1f2c675d9d4393be7dda0a3809a115573eb844071
-
Filesize
172KB
MD5981caaf0bbb52e42de8b8f4cb25d45cf
SHA10907e441c8feb7cdea8be6141af288ada0458958
SHA2564ecd468b163b404534c85cca633d5e5c1e6fecdd064046a4d6956e4d4b11b7b1
SHA512b0be2a3caf17f029e2c480eb5398c63fd33934198980d7e01321cd2dbc52a8c91079be9ec4a8041eb4c405d1f2c675d9d4393be7dda0a3809a115573eb844071
-
Filesize
341KB
MD56cadb955f78ae587d525ee714fc431d0
SHA123be952782126ed5f9a26223e1fba8dc5a5fda30
SHA256f50e655ae92bbb753e145cbb905a985db854cafd4af7b60a30ca88010f912797
SHA512a3b1f64e1e4ae391eff08d5edd94e47dd3b8e60819819a102e8a06bc7baa4a86e55cd0c00b113b780d65abe9a86b4301048295b6352c73d972b16e5ba9aff515
-
Filesize
341KB
MD56cadb955f78ae587d525ee714fc431d0
SHA123be952782126ed5f9a26223e1fba8dc5a5fda30
SHA256f50e655ae92bbb753e145cbb905a985db854cafd4af7b60a30ca88010f912797
SHA512a3b1f64e1e4ae391eff08d5edd94e47dd3b8e60819819a102e8a06bc7baa4a86e55cd0c00b113b780d65abe9a86b4301048295b6352c73d972b16e5ba9aff515
-
Filesize
6KB
MD580bcb0449794dd6c238433a3bd26f5a0
SHA18401251d30803d2bbf0b5b30c027f7446c2d0542
SHA256e07abfe8de7d8acdf74f2ffd3b84e2bd1dbaac5eeffceef4051e21bbc3f02bba
SHA512c5d8a80acf601b19a1cdeb6f129ba37fb3620ddd031c5cd67f8f1e1e26247f3243b884d4bb305f614b794aec42820c69373644309e79c4066c6df7c0f6fc2870
-
Filesize
172KB
MD5981caaf0bbb52e42de8b8f4cb25d45cf
SHA10907e441c8feb7cdea8be6141af288ada0458958
SHA2564ecd468b163b404534c85cca633d5e5c1e6fecdd064046a4d6956e4d4b11b7b1
SHA512b0be2a3caf17f029e2c480eb5398c63fd33934198980d7e01321cd2dbc52a8c91079be9ec4a8041eb4c405d1f2c675d9d4393be7dda0a3809a115573eb844071
-
Filesize
172KB
MD5981caaf0bbb52e42de8b8f4cb25d45cf
SHA10907e441c8feb7cdea8be6141af288ada0458958
SHA2564ecd468b163b404534c85cca633d5e5c1e6fecdd064046a4d6956e4d4b11b7b1
SHA512b0be2a3caf17f029e2c480eb5398c63fd33934198980d7e01321cd2dbc52a8c91079be9ec4a8041eb4c405d1f2c675d9d4393be7dda0a3809a115573eb844071